Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted Chrome

Google Chrome2026-10-20 22:19 UTC1 min readRead in

Summary

Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

Remediation

Inventory every Google Chrome deployment, including staging.
Upgrade Google Chrome to 156.0.8078.47.
Confirm the running version after the upgrade.

References

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
– <156.0.8078.47	156.0.8078.47

Weakness

CWE-862

Exploit probability (EPSS)

0.4%

Timeline

2026-10-20Publicly disclosed

Sources

NVD